Revert commit that removed Russian providers

[JustMarfix]

Explanation

Yesterday, pull request #817 was successfully approved and merged into the main branch. As part of this pull request, all providers affiliated with or based in Russia were removed from the project's repository.

To explain this change, @cam72cam provided two links: README.md and TSC_SUMMARY.md.

Additionally, as part of the discussion in issue #823, @DicsyDel provided information that "it was deemed appropriate to block access from certain territories to avoid any legal issues", citing sanctions on a Russian legal entity.

Why this decision is absolutely wrong and the arguments in its favor do not confirm its correctness

1. README.md, as well as TSC_SUMMARY.md, mention only the restriction on access from Russian IPs to the registry, but not the removal of Russian-related providers from the registry.
2. Here, the U.S. Treasury Office of Foreign Assets Control explains how the restriction on the provision of information technology to Russia should be interpreted. The presence of files from Russian providers in the registry clearly does not fall under these interpretation.
3. Here, the U.S. Treasury Office of Foreign Assets Control explains the nuances of providing information technology to companies affiliated with Russian companies. In particular, Yandex LLC, whose provider was removed from the register, has a subsidiary in Kazakhstan that uses the same provider, which makes it absolutely wrong to exclude the Yandex LLC provider from the register due to US sanctions.

What should be done

The restriction on access to the registry from Russian IP addresses is absolutely justified by the need to comply with US sanctions. However, the removal of Russian-linked providers has nothing to do with compliance with sanctions, which I explained above.

Therefore, these providers should be returned to the registry. I kindly ask you not to close this PR without a full explanation of the reason for such deletion, as well as an answer to my counterarguments. After all, this is an open source, and the community would like to get a good explanation of what happened.

[MikhailAseev]

In addition to the above mentioned

OpenTofu is an open source project published under Mozilla Public License and maintained by Linux Foundation.
Linux Foundation itself has this page where the following is stated:

What kind of open source projects are not subject to the EAR and export restrictions?

All of them. Open source software from the Linux Foundation and project communities we work with is published and made available to the public without restrictions on further dissemination or distribution of the software.
The following typical scenarios (but not an exhaustive list) are not subject to the EAR because “open source” is “published”:

• Open source software that is published publicly is not subject to the EAR
• Open source specifications that are published publicly are not subject to the EAR
• Open source files that describe the designs for hardware that are published publicly are not subject to the EAR
• Open source software binaries that are published publicly are not subject to the EAR

To meet the requirement of “published” under the EAR, however, open source communities may need to take an additional step if the project includes encryption technology.

So, open source projects that are initially published under public licenses cannot be under export controls of the US and EU. This is stated on the official Linux Foundation website.

In this particular case, @ollevche (who is the original author of that PR) and @cam72cam (who approved that PR and merged it) are abusing their positions as the core devs of OpenTofu project.

[evilgn0me]

Looking at this bs, I'm glad that I'm using "closed" Terraform.

[socketpair]

I think that open source is not a place for politics. For what purpose would you remove something related to Russia? For what? Please, don't do bad things to Russian programmers, we are not to blame for what is happening. We help open source just like you help us all.

[kvendingoldo]

The most interesting question: “why only Russia?”; why, for example, not Iran?

open source in now the place for politics.

[dmchmk]

why, for example, not Iran?

*cough*Is*cough*rael*cough*

[097115]

Please, don't do bad things to Russian programmers, we are not to blame for what is happening.

Russian programmers are not to blame for spyware? Bots? Attacks on critical infrastructure all around the world we hear on a daily basis?

Then who are? Martians?

I suggest you to stop playing your famous victim card at last and to start looking in the mirror.

[JustMarfix]

Please stop discussing politics in this PR. There are separate forums for this.
The purpose of this PR is to return incorrectly deleted files back to the registry, not to start a debate about whether Russian programmers are to blame for the actions of Russian hackers. Thank you.

[JoeMcNuggets]

@097115, don't want to dissapoint you, but there are another cybercrime threat sources. But how is it related to violation of OpenTofu license and Linux Foundation policies?

[peter-volkov]

Russian programmers are not to blame for spyware? Bots? Attacks on critical infrastructure all around the world we hear on a daily basis?

Wow. Just wow. Do you know who else once were blaming a big group of people by nationality, citng some specific and hardly credible crimes?

[JustMarfix]

Please just stop. Let's wait for the maintainer's response.

[097115]

@peter-volkov

...And here goes another day Russians once again compare themselves to Holocaust victims :))

Except, sorry to disappoint, you are exactly the other side in this example. So face the consequences.

[slayer]

The decision was absolutely right and totally understandable

[nepridumalnik]

It's fascinating to see how easily the concept of openness and freedom in open source becomes selective. If tomorrow someone decides that developers from another country suddenly become inconvenient, will we continue to restrict access? Or perhaps we'll just forget that the foundation of open source is the exchange of knowledge without borders and discrimination? Maybe it's time to reflect on how far we're willing to go before turning free software into an exclusive club.

[rowaasr13]

@peter-volkov
...And here goes another day Russians once again compare themselves to Holocaust victims :))

You DO realize that 20m of Russian civilian population were murdered in that WW2 thing, do you?
Overwhelmingly by several European countries that pretend to be pinnacles of democratic virtues today. While backing same Banderites as 80 years ago and attacking Russia once again, no less.

Please disappear and take your narratives with you.

[IvanKirpichnikov]

let's better restrict your access to open source

upd: the comment is addressed to everyone who is in favor of deleting

[ixth]

@rowaasr13

same Banderites as 80 years ago

Supporting this discourse you're just making things justifiable.

[Morzan6]

if they deleted Russian providers, then why didn’t they remove Israeli providers as well?
let's be fair

[kotvkvante]

@peter-volkov
...And here goes another day Russians once again compare themselves to Holocaust victims :))

You DO realize that 20m of Russian civilian population were murdered in that WW2 thing, do you? Overwhelmingly by several European countries that pretend to be pinnacles of democratic virtues today. While backing same Banderites as 80 years ago and attacking Russia once again, no less.

Please disappear and take your narratives with you.

Not Russians, USSR civilians. There are were Russians, Ukrainians, Belarusians, and a lot others.

[kotvkvante]

if they deleted Russian providers, then why didn’t they remove Israeli providers as well? let's be fair

Lets be fair and remove everything made by Russians from open source.

[Morzan6]

if they deleted Russian providers, then why didn’t they remove Israeli providers as well? let's be fair

Lets be fair and remove everything made by Russians from open source.

but, this will break the internet
so I don't recommend to do it😁

[specialtactics]

In addition to this, I would like to know what is going to be done to prevent future abuse as was showcased in #817

It is not acceptable that a widely used, open-source, community project can be mishandled so poorly.

[RuslanShf]

I think you can't put your personal interests above the principles of open source community. This is a sign of disrespect for the entire free world. No matter which kind of reasons and restrictions you mean. All of them just in your head.

[gecube]

@Crandel I'd like to ask not to post such a comments because they only create more hate. Also I apologise before my Israeli friends because of almost racist comments on the thread regarding Israel politics against Palestine. All this fight between people is not productive and even more - there are dark forces in the world and large enterprises which are happy to do such a chaos.

[Freezerno]

Россияне, перестаньте жаловаться. Если вы не хотите попасть под санкции, перестаньте терпеть и смените правительство. Все просто. Еще раз, перестаньте работать на режим и разыгрывать жертву.

If you're homeless, just buy a house.

[pryschepa]

Open source community is no-politics place, but, will you be glad to work with some terrorists like North Korea hackers?

just to remind, Russia has more U.S. sanctions than NK and Iran combined. All these 'sberbank' and 'yandex' are under world-wide sanctions.

That is what is called 'evil', so, if we talk about terrorists using open-source software to continue making bad things... i think its not ok.

[omar-nahhas]

I am lucky to be the part of the world that does not (really not ) go around subjugating the rest of the world, stealing their resources, destroying them with illegals wars and then if they dare to resist, tagging them as "the enemy".

[grem11n]

OpenTofu as a community should respect the international law, which caused the original PR.

This revert is a regression in all meanings of the word.

[rusik69]

I am lucky to be the part of the world that does not (really not ) go around subjugating the rest of the world, stealing their resources, destroying them with illegals wars and then if they dare to resist, tagging them as "the enemy".

me too!

[omar-nahhas]

"international law" is a f***g joke. Strange you did not realised during the past 6 months.

[SerhiiK]

Folks, let's start to think about the fork of OpenTofu until the August 26. Vote for this

RuTofu :)

Or maybe CozyTofu

just use the heritage of Russian culture and call it Snokhaсh

[VirtualZer0]

@pryschepa then don't forget to delete all code sections written by people from Russia, Iran and other “terrorists”. Be consistent in your position, otherwise it turns out that you are using a product that “terrorists” were involved in creating. I am afraid to imagine how you sleep at night realizing that part of your libs and apps was written by “evil Russians”.

[kvendingoldo]

@VirtualZer0 and maintainers team should not forget to stop using Nginx / K8S and other tools as well due to evil code inside of these tools.

[rusik69]

if we talk about terrorists using open-source software to continue making bad things... i think its not ok.

thats just a side effect of free information, it can be used by anyone

[sdwvit]

;)

[Insidexa]

Github, being an American company, must comply with sanctions
That's all you need to know :) It's a great time

[Insidexa]

Бро, не стоит желать вреда своей стране. Мне жаль тебя. Претензии к стране - это претензии, прежде всего, к самому себе. Что-то не получилось, не сбылось, не срослось в свое время. Вот и хочется палками и камнями от обиды кидаться.

Где я желал вреда своей стране? Перестаньте быть наивными и путать власть и страну. Не думаю, что большинство россиян, к примеру, поддержали блокировку YouTube.

Хорошо, почему тогда не на баррикадах? Почему не в главе оппозиционного движения? Почему ТЫ не альтернатива для жителей России?

Пока что хватит того, что я не пишу ксенофобские комментарии в защиту режима.

ти нічого не зробив щоб завершити війну.

[ZverGuy]

Github, being an American company, must comply with sanctions

That's all you need to know :) It's a great time

when github asks to delete, then it's worth deleting. What is happening now is simply not following the principles of the Linux Foundation

[eshutov]

@pryschepa

Open source community is no-politics place

You are doing this community a political space. And I have to admit you doing that to your own detriment.
How can you be so brainwashed? (Actually that looks like a trolling.)

terrorists like North Korea hackers

Let's be honest how many terrorists-hackers from DPRK do you know? Please, do count them.
And from the other side: what's about at least "Blackwater" private military company? Who participated in many of conflicts without being a legal participant of them and without following the rules of war? Those are thousands of men.
Dude, where are the sanctions caused by that?

Why supporters of the happening choose such (put it culturally) "strange" arguments?

[oifj34f34f]

ти нічого не зробив щоб завершити війну.

Глобально, да. Но по крайней мере у меня получилось переубедить одного друга.

[ZverGuy]

@opentofu why you don't remove all messages about war?

[cam72cam]

Unfortunately, this has gone too far off topic and has been locked. I apologies to all of you who were trying to discuss this issue in good faith.

[cam72cam]

In discussing with the Linux Foundation, we understand this is a complex issue with many countries imposing sanctions on Russia and we do not have the community resources to figure this all out right now. Anyone in any geography could provide a similar service locally.